Privacy Policy

Effective Date: 24 May 2026 · Version: v2.2.0

This policy describes how TalentVibe Inc. ("TalentVibe", "we") handles personal information collected through our pre-launch waitlist at talentvibe.io. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law. The ten sections below map to PIPEDA Principles 3 (consent), 4 (limiting collection), 5 (limiting use/disclosure/retention), 7 (safeguards), 9 (individual access), and 10 (challenging compliance).

1. What we collect

When you submit the waitlist form, we collect:

Everyone: first name, last name, email address, phone number, and city.
Performers: performer category, years of experience, whether you have completed a paid gig in the last 12 months, a demo link or a "demo to be added later" flag, a short bio, and optional venue references.
Clients: client type and an optional website URL.

We do not collect: precise location (only the city you self-report), IP-based tracking data, third-party analytics cookies, or payment data.

2. Why we collect it

We collect this information for one purpose only: to notify you when TalentVibe launches in your area and to gauge interest by city and role. We will not contact you for any other reason without your further consent. This is the consent you provide when you check the box on the waitlist form (PIPEDA Principle 3 — meaningful consent).

3. How we use it

Send a launch-notification email when bookings go live in your city.
Performers who indicated "demo to be added later" receive a separate follow-up email approximately three days after signup, reminding them to add a demo.
TalentVibe administrators may view rows in our database for moderation and abuse prevention.

Your information is not used for advertising, not sold, and not shared with third parties for their own purposes. We do share data with service providers acting strictly on our behalf — see section 4.1 below (PIPEDA Principle 5 — limiting use).

4. Who sees it

Your information is stored in a Supabase Postgres database in Canada (ca-central-1, Toronto). Supabase Inc. is ISO/IEC 27001 certified for information security management and acts as our data processor under a written Data Processing Agreement. The data is accessed only by TalentVibe administrators via row-level-security-restricted queries. We will disclose your information to third parties only if compelled by Canadian court order.

4.1 Service providers we use today (waitlist)

To operate the waitlist, we use the following service providers. Each acts on our behalf under a written Data Processing Agreement and may only use your data to perform the function listed.

Supabase Inc. — database, authentication, and edge functions. Data hosted in Canada (Toronto, ca-central-1).
Resend Inc. — transactional email delivery (waitlist welcome and follow-up emails). Processes your email address and first name only. Resend Inc. is incorporated in the United States.
Vercel Inc. — application hosting and global content delivery network. Vercel processes HTTP requests but does not log personal data on our behalf. Vercel Inc. is incorporated in the United States; CDN edges operate globally.

4.2 Additional processors at marketplace launch

When TalentVibe's booking marketplace goes live (separate from this waitlist), we will additionally use:

Stripe — payment processing for bookings. Receives your payment instrument, transaction amount, and billing email directly via Stripe Elements — we never see or store your card number. Stripe processes Canadian transactions through Stripe Payments Canada Ltd.; fraud-detection signals may be evaluated in the United States. Subject to a written DPA.
Sentry (Functional Software Inc.) — anonymized diagnostic error monitoring. Sentry receives only technical error reports with cookies, authentication headers, request bodies, email addresses, and IP addresses stripped at our application layer before transmission. The only identifier sent is a random database UUID linked to your session, never your name or email. Sentry servers are located in the United States; subject to a written DPA. We use Sentry because no Canadian-hosted equivalent currently meets our reliability requirements; the data minimization above is our PIPEDA-aligned mitigation.

This policy will be re-versioned at marketplace launch with effective dates for the additional processors. You will be notified by email and asked to consent to the new version before continuing to use the marketplace.

5. How long we keep it

24 months from your signup date, after which your record is deleted. If TalentVibe launches in your area before 24 months elapse and you create an account, your waitlist record is migrated to your account (with new consent at that time) and the standalone waitlist record is deleted (PIPEDA Principle 5 — retention).

6. How to access or delete your data

Email hello@talentvibe.io from the address you signed up with. We will delete your record within 30 days. You can also request a copy of your record (right of access, PIPEDA Principles 9 and 10).

7. Security

We use TLS in transit and row-level security at rest. Our anonymous public key has no SELECT permission on the waitlist table — only INSERT (a soft-launch deviation; v2.1.1 adds an edge function with rate-limiting and bot mitigation). This addresses PIPEDA Principle 7 — safeguards.

In the event of a privacy breach, we follow PIPEDA's Breach of Security Safeguards Regulations: any breach posing a real risk of significant harm is reported to the Office of the Privacy Commissioner of Canada and to affected individuals as soon as feasible. Our breach-response runbook and 24-month breach log are maintained internally; contact hello@talentvibe.io to reach the Privacy Officer (Alex Kopacz).

8. Changes to this policy

We will not retroactively change the use of data already collected. New versions of this policy apply only to signups received after the new effective date. The version of the policy you consented to is recorded against your waitlist record at signup time.

9. Contact

TalentVibe Inc. · London, Ontario · hello@talentvibe.io

Privacy Officer: Alex Kopacz, Founder · hello@talentvibe.io (PIPEDA Principle 1 — Accountability; Quebec Law 25 § 3.1)

10. About this version

This is privacy policy version v2.2.0, effective 24 May 2026. Stored as policy_version='v2.2.0' against your waitlist record so you and we can both prove which policy text your consent applies to.

Changes from v2.1.0:

Updated Supabase hosting region from US East 2 (Ohio) to Canada Central (Toronto, ca-central-1), reflecting our database migration completed in May 2026.
Added section 4.1 disclosing all service providers currently used for the waitlist (Supabase, Resend, Vercel) with their roles, locations, and DPA status.
Added section 4.2 disclosing additional processors (Stripe for payments, Sentry for anonymized diagnostic error monitoring) that will apply when the booking marketplace launches.

Existing waitlist signups consented under v2.1.0 remain governed by v2.1.0 for their original collection purposes. v2.2.0 applies to signups received on or after 24 May 2026 and to any future processing for which we obtain renewed consent at marketplace launch.